Flowmon for KVM

Overview

Flowmon for KVM gives network administrators and security engineers insight into what is happening in their infrastructure. You can use its powerful features to gain control of bandwidth utilization, optimize network and application performance, reduce time to resolution during troubleshooting, and keep the infrastructure protected against modern cyber-security threats.

Flowmon for KVM is:

• a virtual appliance intended for the KVM environment,
• capable of collecting in addition to generating flow data,
• fully under your control - including updates, backups, and configuration.

This guide describes how to deploy Flowmon for KVM using a set of qcow2 disk images. You can change the predefined storage capacity later to match the purchased license.

Operating modes

Flowmon for KVM works in three modes:

• Probe
• Collector
• Collector and Probe

Flowmon Probe

In Probe mode, your virtual appliance:

• Accepts mirrored traffic on monitoring ports
• Exports flow data to Flowmon Collector instances
• Monitors traffic from supported network sources
• Monitors traffic on Open vSwitches using port mirroring

Flowmon Collector mode

In Collector mode, your virtual appliance:

• Accepts flow data from external probes, network devices, or cloud services
• Works with all supported Network Flows Source Types

For details on supported flow sources and formats, refer to the official Flowmon User Guide.

Collector and Probe mode

In Collector and Probe mode, your virtual appliance:

• Acts as both a Flowmon Probe and Collector
• Sends data to the locally available Collector

For configuration details, refer to the official Flowmon User Guide.

Licensing

Flowmon for KVM is a virtual appliance using the Bring-Your-Own-License (BYOL) licensing model.

With BYOL, you can apply for a Free Trial License at progress.com.

For support or inquiries, see our contact information.

Prerequisites

To follow this guide, you need:

• A KVM-based host with a graphical user interface and Virtual Machine Manager installed.
• Flowmon for KVM downloaded from the Flowmon Downloads page. Archives for download are located in Flowmon Platform / <FlowmonVersion> / Flowmon for KVM. Unless directed otherwise, pick the latest stable version with the desired set of modules.
• A valid Flowmon license or a trial license from progress.com.

Deployment

To deploy Flowmon for KVM:

1. Unzip the archive.

2. Start the Virtual Machine Manager application.

3. Select File > New virtual machine.

4. Select Import existing disk image and click Forward.

5. Select the path to the unzipped file, choose disk 0, and confirm the settings with the Choose Volume button.

6. Select CentOS 7.0 as the OS type and click Forward.

7. Assign CPU cores and RAM to the appliance (recommended minimum: 8 CPUs and 16 GB RAM).

8. Set a Name for the appliance, check the Customize configuration before install option, and click Finish.

9. In the VM configuration, set the video device model to Virtio. Depending on the platform and version, this setting may be labeled Video or Display, and the model value may appear as virtio-vga or virtio-gpu.

10. Select VirtIO Disk 1, select VirtIO as the Disk bus, and click Apply. Then, click Add Hardware to add a data drive.

11. Select the Storage option and choose Select or create custom storage. The Bus type option must be set to VirtIO. Then, click Manage ... to browse for images.

12. Select disk 1 and click Choose Volume.

13. Click Finish to confirm the setup.

14. Select the Boot Options category and select VirtIO Disk 1 as a primary disk from which to boot the appliance.

15. Add as many interfaces as needed to create all interfaces of a Flowmon appliance (three more for the Flowmon Collector, 1+N for the Flowmon Probe with N monitoring ports). Click Add Hardware, select Network, select the Network source and Device model (virtio), and click Finish.

16. After adding the interfaces, you can begin the installation by clicking Begin Installation.

Memory ballooning

Memory ballooning is a memory management technique that allows the hypervisor to reclaim memory from virtual machines when the host is under memory pressure. Ballooning can affect the performance of your virtual appliance because it reduces the amount of memory available to the guest operating system. To maintain optimal performance, ensure that ballooned memory remains as low as possible.

Flowmon Configuration

Refer to the following section: Post-installation Steps.